From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754829AbdEHUn2 (ORCPT ); Mon, 8 May 2017 16:43:28 -0400 Received: from mail-pg0-f65.google.com ([74.125.83.65]:36617 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752897AbdEHUn1 (ORCPT ); Mon, 8 May 2017 16:43:27 -0400 Date: Mon, 8 May 2017 13:43:23 -0700 From: Dmitry Torokhov To: Greg Kroah-Hartman Cc: Arve =?iso-8859-1?B?SGr4bm5lduVn?= , Riley Andrews , Martijn Coenen , John Stultz , Douglas Anderson , devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Subject: [PATCH] android: binder: check result of binder_get_thread() in binder_poll() Message-ID: <20170508204323.GA28410@dtor-ws> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If binder_get_thread() fails to give us a thread data, we should avoid dereferencing a NULL pointer and return POLLERR instead. Signed-off-by: Dmitry Torokhov --- drivers/android/binder.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index aae4d8d4be36..66ed714fedd5 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3103,18 +3103,22 @@ static unsigned int binder_poll(struct file *filp, struct poll_table_struct *wait) { struct binder_proc *proc = filp->private_data; - struct binder_thread *thread = NULL; + struct binder_thread *thread; int wait_for_proc_work; binder_lock(__func__); thread = binder_get_thread(proc); - - wait_for_proc_work = thread->transaction_stack == NULL && - list_empty(&thread->todo) && thread->return_error == BR_OK; + if (thread) + wait_for_proc_work = thread->transaction_stack == NULL && + list_empty(&thread->todo) && + thread->return_error == BR_OK; binder_unlock(__func__); + if (!thread) + return POLLERR; + if (wait_for_proc_work) { if (binder_has_proc_work(proc, thread)) return POLLIN; -- 2.13.0.rc1.294.g07d810a77f-goog -- Dmitry